Your gateway sent that webhook twice. Did your books?

@app.post("/webhooks/payments")
async def payment_webhook(request, db):
    raw = await request.body()
    verify_signature(raw, request.headers["X-Signature"])  # forged? stop here
    event = json.loads(raw)

    try:
        async with db.transaction():
            await db.execute(
                "INSERT INTO processed_events (event_id) VALUES ($1)",
                event["id"],                          # UNIQUE: a repeat fails here
            )
            await post_ledger_entry(db, event)       # same transaction: all or nothing
    except UniqueViolationError:
        return {"status": "duplicate_ignored"}      # 200, so the gateway stops retrying

    return {"status": "posted"}